Verification of the IPsec data path before a point-to-point secure tunnel (st0) interface is activated

The IPsec data path between VPN tunnel endpoints can be verified before the secure tunnel (st0) interface is activated and routes associated with the interface are installed in the Junos OS forwarding table. This feature applies to route-based site-to-site and dynamic endpoint VPNs with st0 interfaces in point-to-point mode. To configure the IPsec data path verification, use the verify-path statement at the [edit security ipsec vpn vpn-name vpn-monitor] hierarchy level. If the peer tunnel endpoint is behind a NAT device, the verify-path destination-ip option must be specified with the original, untranslated IP address of the remote IKE gateway.